# ===== ap1 (10.40.41.155) — CAPsMAN-Manager + AP + VLAN-Bridge =====
# RouterOS 7.23.1. NUR PLAN — Syntax vor Apply gegen Gerät validieren.
# Platzhalter <...> ersetzen. L3/Router-Teil (DHCP/DNS/NAT/CAKE) NICHT hier (separater Cutover).

# --- 1) Bridge-VLAN-Tabelle (Uplink ether2 = Trunk, native vlan1 = Mgmt) ---
/interface bridge vlan
add bridge=bridge vlan-ids=10,20,30,40,90,99,100 tagged=bridge,ether2
add bridge=bridge vlan-ids=1 untagged=ether2,ether3,ether4,ether5 tagged=bridge
/interface bridge port
set [find interface=ether2] pvid=1            ;# native/untagged = vlan1 (Mgmt)

# --- 2) WLAN Security (Passphrasen vom User) ---
# TEMP-Passphrase (Platzhalter) — User setzt echte später
/interface wifi security
add name=sec-main  authentication-types=wpa3-psk          passphrase="BFtest-2026-tmp"  ;# WPA3-only (User)
add name=sec-iot   authentication-types=wpa2-psk,wpa3-psk passphrase="BFtest-2026-tmp"
add name=sec-guest authentication-types=wpa2-psk,wpa3-psk passphrase="BFtest-2026-tmp"

# --- 3) Datapath = VLAN-Zuordnung (Bridge + vlan-id) ---
/interface wifi datapath
add name=dp-main  bridge=bridge vlan-id=10
add name=dp-iot   bridge=bridge vlan-id=30
add name=dp-guest bridge=bridge vlan-id=90

# --- 4) Configuration je SSID ---
/interface wifi configuration
add name=cfg-main  ssid="BF-Main"  security=sec-main  datapath=dp-main  country=Austria
add name=cfg-iot   ssid="BF-IoT"   security=sec-iot   datapath=dp-iot   country=Austria
add name=cfg-guest ssid="BF-Guest" security=sec-guest datapath=dp-guest country=Austria

# --- 5) CAPsMAN-Manager aktivieren (CA/Cert generiert RouterOS automatisch) ---
/interface wifi capsman
set enabled=yes interfaces=bridge ca-certificate=auto certificate=auto

# --- 6) Provisioning: pro Radio Master(BF-Main)+Slaves(IoT,Guest) dynamisch anlegen ---
/interface wifi provisioning
add action=create-dynamic-enabled supported-bands=2ghz-ax \
    master-configuration=cfg-main slave-configurations=cfg-iot,cfg-guest
add action=create-dynamic-enabled supported-bands=5ghz-ax \
    master-configuration=cfg-main slave-configurations=cfg-iot,cfg-guest

# --- 7) SAFETY: Auto-Rollback, DANN vlan-filtering an ---
/system scheduler
add name=vlan-rollback interval=5m \
  on-event="/interface bridge set [find name=bridge] vlan-filtering=no; /system scheduler remove vlan-rollback"
/interface bridge set [find name=bridge] vlan-filtering=yes
# Nach bestätigtem Zugriff:  /system scheduler remove vlan-rollback